{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nuget 4.6.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ChakraCore",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Mono Framework Version 5.18.0.223",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Team Foundation Server 2018 Update 3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visual Studio pour Mac",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Skype pour Business Server 2015 March 2019 Update",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Mono Framework Version 5.20.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2017 version 15.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.8.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Team Foundation Server 2017 Update 3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 (on-premises) version 8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.9.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Lync Server 2013 July 2018 Update",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Team Foundation Server 2018 Updated 1.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "UbuntuServer:18.04-LTS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-0639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0639"
    },
    {
      "name": "CVE-2019-0769",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0769"
    },
    {
      "name": "CVE-2019-0592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0592"
    },
    {
      "name": "CVE-2019-0777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0777"
    },
    {
      "name": "CVE-2019-0809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0809"
    },
    {
      "name": "CVE-2019-0798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0798"
    },
    {
      "name": "CVE-2019-0746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0746"
    },
    {
      "name": "CVE-2019-0757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0757"
    },
    {
      "name": "CVE-2019-0611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0611"
    },
    {
      "name": "CVE-2019-0773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0773"
    },
    {
      "name": "CVE-2018-8654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8654"
    },
    {
      "name": "CVE-2019-0609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0609"
    },
    {
      "name": "CVE-2019-0771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0771"
    },
    {
      "name": "CVE-2019-0816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0816"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-106",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une ex\u00e9cution de code \u00e0 distance, une\nusurpation d\u0027identit\u00e9 et un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 mars 2019",
      "url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nuget 4.6.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "ChakraCore",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Mono Framework Version 5.18.0.223",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Team Foundation Server 2018 Update 3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.4.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visual Studio pour Mac",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.7.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Skype pour Business Server 2015 March 2019 Update",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Mono Framework Version 5.20.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2017 version 15.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.8.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Team Foundation Server 2017 Update 3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 (on-premises) version 8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.9.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Lync Server 2013 July 2018 Update",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Team Foundation Server 2018 Updated 1.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "UbuntuServer:18.04-LTS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Nuget 4.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-0639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0639"
    },
    {
      "name": "CVE-2019-0769",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0769"
    },
    {
      "name": "CVE-2019-0592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0592"
    },
    {
      "name": "CVE-2019-0777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0777"
    },
    {
      "name": "CVE-2019-0809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0809"
    },
    {
      "name": "CVE-2019-0798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0798"
    },
    {
      "name": "CVE-2019-0746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0746"
    },
    {
      "name": "CVE-2019-0757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0757"
    },
    {
      "name": "CVE-2019-0611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0611"
    },
    {
      "name": "CVE-2019-0773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0773"
    },
    {
      "name": "CVE-2018-8654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8654"
    },
    {
      "name": "CVE-2019-0609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0609"
    },
    {
      "name": "CVE-2019-0771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0771"
    },
    {
      "name": "CVE-2019-0816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0816"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-106",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une ex\u00e9cution de code \u00e0 distance, une\nusurpation d\u0027identit\u00e9 et un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 mars 2019",
      "url": "https://portal.msrc.microsoft.com/fr-FR/security-guidance"
    }
  ]
}

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "18.04 LTS (Ubuntu), - (Microsoft Azure)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.03.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "22.03.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-01142",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-0816",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Microsoft Azure",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b cloud-init \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0431\u0445\u043e\u0434 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0430, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c (CWE-639)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u044b cloud-init \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043a\u043b\u044e\u0447\u0435\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-639",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,4)"
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:azure:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "511CBA4F-AC08-4500-A1FC-1804B84C09A7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027."
    },
    {
      "lang": "es",
      "value": "Existe una omisi\u00f3n de la caracter\u00edstica de seguridad en Azure SSH Keypairs, debido a un cambio en la l\u00f3gica de aprovisionamiento para algunas im\u00e1genes de Linux que usan cloud-init, tambi\u00e9n se conoce como \"Azure SSH Keypairs Security Feature Bypass Vulnerability\"."
    }
  ],
  "id": "CVE-2019-0816",
  "lastModified": "2024-11-21T04:17:19.880",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 1.9,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-04-09T03:29:00.937",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00018.html"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00018.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-706"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-0816"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-706"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-09T03:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
  "id": "GHSA-gjp8-2rjx-f9mg",
  "modified": "2022-05-13T01:21:37Z",
  "published": "2022-05-13T01:21:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0816"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00018.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2019-0816",
    "description": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
    "id": "GSD-2019-0816",
    "references": [
      "https://www.suse.com/security/cve/CVE-2019-0816.html",
      "https://access.redhat.com/errata/RHBA-2019:1992",
      "https://access.redhat.com/errata/RHSA-2019:0597",
      "https://linux.oracle.com/cve/CVE-2019-0816.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-0816"
      ],
      "details": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
      "id": "GSD-2019-0816",
      "modified": "2023-12-13T01:23:38.952739Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2019-0816",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Ubuntu Server",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "18.04-LTS"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Security Feature Bypass"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816",
            "refsource": "CONFIRM",
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816"
          },
          {
            "name": "openSUSE-SU-2019:2633",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00018.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:azure:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0816"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-706"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0816"
            },
            {
              "name": "openSUSE-SU-2019:2633",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00018.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 1.9,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.4,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 1.4,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2020-08-24T17:37Z",
      "publishedDate": "2019-04-09T03:29Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for cloud-init",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for cloud-init to version 19.2 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-0816: Fixed the unnecessary extra ssh keys that were added to authorized_keys (bsc#1129124).\n\nNon-security issues fixed:\n\n- Short circuit the conditional for identifying the sysconfig renderer (bsc#1154092, bsc#1142988).\n- If /etc/resolv.conf is a symlink, break it. This will avoid netconfig from clobbering the changes cloud-init applied (bsc#1151488).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2019-2633",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_2633-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2019:2633-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BTJ6XBYKM5GEQXOHG36W55QBQGBBSDPD/#BTJ6XBYKM5GEQXOHG36W55QBQGBBSDPD"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2019:2633-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BTJ6XBYKM5GEQXOHG36W55QBQGBBSDPD/#BTJ6XBYKM5GEQXOHG36W55QBQGBBSDPD"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1099358",
        "url": "https://bugzilla.suse.com/1099358"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1129124",
        "url": "https://bugzilla.suse.com/1129124"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1136440",
        "url": "https://bugzilla.suse.com/1136440"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1142988",
        "url": "https://bugzilla.suse.com/1142988"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1144363",
        "url": "https://bugzilla.suse.com/1144363"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1151488",
        "url": "https://bugzilla.suse.com/1151488"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1154092",
        "url": "https://bugzilla.suse.com/1154092"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-0816 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-0816/"
      }
    ],
    "title": "Security update for cloud-init",
    "tracking": {
      "current_release_date": "2019-12-03T23:15:41Z",
      "generator": {
        "date": "2019-12-03T23:15:41Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2019:2633-1",
      "initial_release_date": "2019-12-03T23:15:41Z",
      "revision_history": [
        {
          "date": "2019-12-03T23:15:41Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-19.2-lp151.2.9.1.x86_64",
                "product": {
                  "name": "cloud-init-19.2-lp151.2.9.1.x86_64",
                  "product_id": "cloud-init-19.2-lp151.2.9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-config-suse-19.2-lp151.2.9.1.x86_64",
                "product": {
                  "name": "cloud-init-config-suse-19.2-lp151.2.9.1.x86_64",
                  "product_id": "cloud-init-config-suse-19.2-lp151.2.9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-doc-19.2-lp151.2.9.1.x86_64",
                "product": {
                  "name": "cloud-init-doc-19.2-lp151.2.9.1.x86_64",
                  "product_id": "cloud-init-doc-19.2-lp151.2.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-19.2-lp151.2.9.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:cloud-init-19.2-lp151.2.9.1.x86_64"
        },
        "product_reference": "cloud-init-19.2-lp151.2.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-config-suse-19.2-lp151.2.9.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:cloud-init-config-suse-19.2-lp151.2.9.1.x86_64"
        },
        "product_reference": "cloud-init-config-suse-19.2-lp151.2.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-doc-19.2-lp151.2.9.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:cloud-init-doc-19.2-lp151.2.9.1.x86_64"
        },
        "product_reference": "cloud-init-doc-19.2-lp151.2.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-0816",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-0816"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:cloud-init-19.2-lp151.2.9.1.x86_64",
          "openSUSE Leap 15.1:cloud-init-config-suse-19.2-lp151.2.9.1.x86_64",
          "openSUSE Leap 15.1:cloud-init-doc-19.2-lp151.2.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-0816",
          "url": "https://www.suse.com/security/cve/CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1129124 for CVE-2019-0816",
          "url": "https://bugzilla.suse.com/1129124"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:cloud-init-19.2-lp151.2.9.1.x86_64",
            "openSUSE Leap 15.1:cloud-init-config-suse-19.2-lp151.2.9.1.x86_64",
            "openSUSE Leap 15.1:cloud-init-doc-19.2-lp151.2.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Leap 15.1:cloud-init-19.2-lp151.2.9.1.x86_64",
            "openSUSE Leap 15.1:cloud-init-config-suse-19.2-lp151.2.9.1.x86_64",
            "openSUSE Leap 15.1:cloud-init-doc-19.2-lp151.2.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-12-03T23:15:41Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-0816"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cloud-init-21.2-1.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the cloud-init-21.2-1.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10688",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10688-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-0816 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-0816/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8631 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8631/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8632 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8632/"
      }
    ],
    "title": "cloud-init-21.2-1.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10688-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-21.2-1.2.aarch64",
                "product": {
                  "name": "cloud-init-21.2-1.2.aarch64",
                  "product_id": "cloud-init-21.2-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-config-suse-21.2-1.2.aarch64",
                "product": {
                  "name": "cloud-init-config-suse-21.2-1.2.aarch64",
                  "product_id": "cloud-init-config-suse-21.2-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-doc-21.2-1.2.aarch64",
                "product": {
                  "name": "cloud-init-doc-21.2-1.2.aarch64",
                  "product_id": "cloud-init-doc-21.2-1.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-21.2-1.2.ppc64le",
                "product": {
                  "name": "cloud-init-21.2-1.2.ppc64le",
                  "product_id": "cloud-init-21.2-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-config-suse-21.2-1.2.ppc64le",
                "product": {
                  "name": "cloud-init-config-suse-21.2-1.2.ppc64le",
                  "product_id": "cloud-init-config-suse-21.2-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-doc-21.2-1.2.ppc64le",
                "product": {
                  "name": "cloud-init-doc-21.2-1.2.ppc64le",
                  "product_id": "cloud-init-doc-21.2-1.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-21.2-1.2.s390x",
                "product": {
                  "name": "cloud-init-21.2-1.2.s390x",
                  "product_id": "cloud-init-21.2-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-config-suse-21.2-1.2.s390x",
                "product": {
                  "name": "cloud-init-config-suse-21.2-1.2.s390x",
                  "product_id": "cloud-init-config-suse-21.2-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-doc-21.2-1.2.s390x",
                "product": {
                  "name": "cloud-init-doc-21.2-1.2.s390x",
                  "product_id": "cloud-init-doc-21.2-1.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-21.2-1.2.x86_64",
                "product": {
                  "name": "cloud-init-21.2-1.2.x86_64",
                  "product_id": "cloud-init-21.2-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-config-suse-21.2-1.2.x86_64",
                "product": {
                  "name": "cloud-init-config-suse-21.2-1.2.x86_64",
                  "product_id": "cloud-init-config-suse-21.2-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "cloud-init-doc-21.2-1.2.x86_64",
                "product": {
                  "name": "cloud-init-doc-21.2-1.2.x86_64",
                  "product_id": "cloud-init-doc-21.2-1.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-21.2-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64"
        },
        "product_reference": "cloud-init-21.2-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-21.2-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le"
        },
        "product_reference": "cloud-init-21.2-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-21.2-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x"
        },
        "product_reference": "cloud-init-21.2-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-21.2-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64"
        },
        "product_reference": "cloud-init-21.2-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-config-suse-21.2-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64"
        },
        "product_reference": "cloud-init-config-suse-21.2-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-config-suse-21.2-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le"
        },
        "product_reference": "cloud-init-config-suse-21.2-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-config-suse-21.2-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x"
        },
        "product_reference": "cloud-init-config-suse-21.2-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-config-suse-21.2-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64"
        },
        "product_reference": "cloud-init-config-suse-21.2-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-doc-21.2-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64"
        },
        "product_reference": "cloud-init-doc-21.2-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-doc-21.2-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le"
        },
        "product_reference": "cloud-init-doc-21.2-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-doc-21.2-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x"
        },
        "product_reference": "cloud-init-doc-21.2-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-doc-21.2-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
        },
        "product_reference": "cloud-init-doc-21.2-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-0816",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-0816"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-0816",
          "url": "https://www.suse.com/security/cve/CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1129124 for CVE-2019-0816",
          "url": "https://bugzilla.suse.com/1129124"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-0816"
    },
    {
      "cve": "CVE-2020-8631",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8631"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8631",
          "url": "https://www.suse.com/security/cve/CVE-2020-8631"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162937 for CVE-2020-8631",
          "url": "https://bugzilla.suse.com/1162937"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8631"
    },
    {
      "cve": "CVE-2020-8632",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8632"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
          "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8632",
          "url": "https://www.suse.com/security/cve/CVE-2020-8632"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162936 for CVE-2020-8632",
          "url": "https://bugzilla.suse.com/1162936"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-config-suse-21.2-1.2.x86_64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.aarch64",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.ppc64le",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.s390x",
            "openSUSE Tumbleweed:cloud-init-doc-21.2-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8632"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for cloud-init is now available for Red Hat Enterprise Linux 8.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.\n\nUsers of cloud-init are advised to upgrade to these updated packages.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2019:1992",
        "url": "https://access.redhat.com/errata/RHBA-2019:1992"
      },
      {
        "category": "external",
        "summary": "1687563",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687563"
      },
      {
        "category": "external",
        "summary": "1728625",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728625"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_1992.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: cloud-init bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2025-11-21T17:21:59+00:00",
      "generator": {
        "date": "2025-11-21T17:21:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHBA-2019:1992",
      "initial_release_date": "2019-07-30T19:33:22+00:00",
      "revision_history": [
        {
          "date": "2019-07-30T19:33:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-07-30T19:33:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:21:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.0.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-0:18.5-1.el8.4.src",
                "product": {
                  "name": "cloud-init-0:18.5-1.el8.4.src",
                  "product_id": "cloud-init-0:18.5-1.el8.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cloud-init@18.5-1.el8.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-0:18.5-1.el8.4.noarch",
                "product": {
                  "name": "cloud-init-0:18.5-1.el8.4.noarch",
                  "product_id": "cloud-init-0:18.5-1.el8.4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cloud-init@18.5-1.el8.4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-0:18.5-1.el8.4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch"
        },
        "product_reference": "cloud-init-0:18.5-1.el8.4.noarch",
        "relates_to_product_reference": "AppStream-8.0.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-0:18.5-1.el8.4.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
        },
        "product_reference": "cloud-init-0:18.5-1.el8.4.src",
        "relates_to_product_reference": "AppStream-8.0.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-0816",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2019-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1680165"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cloud-init: extra ssh keys added to authorized_keys on the Azure platform",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
          "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "RHBZ#1680165",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1680165"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0816",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0816",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm",
          "url": "https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm"
        }
      ],
      "release_date": "2019-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-07-30T19:33:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2019:1992"
        },
        {
          "category": "workaround",
          "details": "See steps from https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm",
          "product_ids": [
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cloud-init: extra ssh keys added to authorized_keys on the Azure platform"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for cloud-init is now available for Red Hat Enterprise Linux 8.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts.\n\nUsers of cloud-init are advised to upgrade to these updated packages.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2019:1992",
        "url": "https://access.redhat.com/errata/RHBA-2019:1992"
      },
      {
        "category": "external",
        "summary": "1687563",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687563"
      },
      {
        "category": "external",
        "summary": "1728625",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728625"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_1992.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: cloud-init bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-22T12:46:37+00:00",
      "generator": {
        "date": "2024-11-22T12:46:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHBA-2019:1992",
      "initial_release_date": "2019-07-30T19:33:22+00:00",
      "revision_history": [
        {
          "date": "2019-07-30T19:33:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-07-30T19:33:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T12:46:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.0.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-0:18.5-1.el8.4.src",
                "product": {
                  "name": "cloud-init-0:18.5-1.el8.4.src",
                  "product_id": "cloud-init-0:18.5-1.el8.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cloud-init@18.5-1.el8.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cloud-init-0:18.5-1.el8.4.noarch",
                "product": {
                  "name": "cloud-init-0:18.5-1.el8.4.noarch",
                  "product_id": "cloud-init-0:18.5-1.el8.4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cloud-init@18.5-1.el8.4?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-0:18.5-1.el8.4.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch"
        },
        "product_reference": "cloud-init-0:18.5-1.el8.4.noarch",
        "relates_to_product_reference": "AppStream-8.0.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cloud-init-0:18.5-1.el8.4.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
        },
        "product_reference": "cloud-init-0:18.5-1.el8.4.src",
        "relates_to_product_reference": "AppStream-8.0.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-0816",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2019-02-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1680165"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, aka \u0027Azure SSH Keypairs Security Feature Bypass Vulnerability\u0027.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cloud-init: extra ssh keys added to authorized_keys on the Azure platform",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
          "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "RHBZ#1680165",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1680165"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0816",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0816",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0816"
        },
        {
          "category": "external",
          "summary": "https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm",
          "url": "https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm"
        }
      ],
      "release_date": "2019-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-07-30T19:33:22+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2019:1992"
        },
        {
          "category": "workaround",
          "details": "See steps from https://support.microsoft.com/en-us/help/4491476/extraneous-ssh-public-keys-added-to-authorized-keys-file-on-linux-vm",
          "product_ids": [
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.noarch",
            "AppStream-8.0.1:cloud-init-0:18.5-1.el8.4.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cloud-init: extra ssh keys added to authorized_keys on the Azure platform"
    }
  ]
}